aboutsummaryrefslogtreecommitdiffstats
path: root/secrets
AgeCommit message (Collapse)AuthorFilesLines
17 hoursci: sign and publish HardenedPass releases with the fork's own keyDanilo M.2-0/+0
Add the fork's release keystore and its signing properties, encrypted with openssl (aes-256-cbc, pbkdf2) as secrets/keystore.cipher and secrets/props.cipher; the key is the ENCRYPT_KEY repository secret. The plaintext files and the master copy never enter the repository. Rewrite deploy_github_releases.yml for the single FOSS build: on a vX.Y.Z tag it decrypts the signing secrets, builds the signed release APK, removes the secrets, and creates a draft GitHub Release with HardenedPass_<tag>.apk and its SHA-256 checksum using gh, replacing the archived actions/create-release and upload-release-asset actions. AGENTS.md records the certificate fingerprint and the procedure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 hoursci: run checks on push to master, schedule CodeQLDanilo M.2-0/+0
The check workflow only triggered on pull requests, so direct pushes to master were never built or tested. Trigger it on push to master as well and rename it to CI. Run CodeQL weekly instead of manual-only. Remove draft_new_release.yml, which is built around upstream's develop and release-X.Y branch model, and upstream's encrypted signing keystore and properties, which only upstream can decrypt. Release signing needs a keystore of our own before deploy_github_releases.yml can run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2020-10-16Revamp build configuration (#1156)Harsh Shandilya2-0/+0
* release: move scripts to scripts directory Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * Move CI secrets to secrets directory Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * gradle: uprev to 6.7 Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * gradle: suppress warnings about unsupported options Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * build: update dependencies Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * build: move Gradle plugins to ext Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * build: move configuration tasks to buildSrc Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * CHANGELOG: add entry for #1137 Signed-off-by: Harsh Shandilya <me@msfjarvis.dev> * Fix lint warnings Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>